Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\rocketlife\shell\open\command] '' = '"%LOCALAPPDATA%\RLPlatform\RocketLife.exe" "%1"'
Creates or modifies the following files
- %WINDIR%\tasks\hp photo creations communicator.job
- <SYSTEM32>\tasks\hp photo creations communicator
Modifies file system
Creates the following files
- %TEMP%\nsh2c00.tmp\photoproductcore.exe
- %APPDATA%\hp photo creations\photoproduct.exe
- %APPDATA%\hp photo creations\photoproduct.ico
- %APPDATA%\hp photo creations\photoproduct.sp
- %HOMEPATH%\desktop\hp photo creations.lnk
- %TEMP%\nsh2c00.tmp\applicationid.dll
- %HOMEPATH%\desktop\~p photo creations.tmp
- %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\hp photo creations.lnk
- %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\~p photo creations.tmp
- %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\uninstall hp photo creations.lnk
- %APPDATA%\visan\plugins\pplauncher-1.4.0.22192.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\u_btn_04[1].jpg
- %APPDATA%\visan\plugins\pplauncher-1.4.0.22192.dll.sig
- %LOCALAPPDATA%\rlplatform\rocketlife.exe
- %LOCALAPPDATA%\rlplatform\proto\rlproto.1.0.0.22192.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\shindex[1].html
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\shindex_langs[1].js
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\basecode[1].js
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\config[1].js
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\shellconfig[1].js
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\u_btn_03[1].jpg
- %APPDATA%\hp photo creations\remove.exe
- %APPDATA%\visan\plugins\nprlsecurepluginlayer.dll
- %APPDATA%\visan\appicons\hp photo creations.ico
- %APPDATA%\hp photo creations\opensans-regular.ttf
- %TEMP%\nsh2c00.tmp\photoproductcore.sp
- %TEMP%\nsh2c00.tmp\system.dll
- %APPDATA%\hp photo creations\photoproductcore.exe
- %APPDATA%\hp photo creations\photoproductcore.sp
- %APPDATA%\hp photo creations\conf\app.dat
- %APPDATA%\hp photo creations\conf\content.dat
- %APPDATA%\hp photo creations\conf\themes.dat
- %APPDATA%\hp photo creations\conf\reseller0.dat
- %APPDATA%\hp photo creations\photoproductcore.ico
- %APPDATA%\hp photo creations\opensans-bold.ttf
- %APPDATA%\hp photo creations\communicator.exe
- %APPDATA%\hp photo creations\opensans-italic.ttf
- %APPDATA%\hp photo creations\rl.conf
- %APPDATA%\hp photo creations\app.conf
- %APPDATA%\hp photo creations\rocketengine.dll
- %APPDATA%\hp photo creations\contentman.dll
- %APPDATA%\hp photo creations\rlpnupload.dll
- %APPDATA%\hp photo creations\caintermediate.pem
- %APPDATA%\hp photo creations\nprlviewer.dll
- %APPDATA%\hp photo creations\photoproductreg.exe
- %TEMP%\nsh2c00.tmp\nsexec.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021061420210615\index.dat
Deletes the following files
- %HOMEPATH%\desktop\hp photo creations.lnk~rf125521.tmp
- %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\hp photo creations.lnk~rf125550.tmp
- %TEMP%\nsh2c00.tmp\applicationid.dll
- %TEMP%\nsh2c00.tmp\nsexec.dll
- %TEMP%\nsh2c00.tmp\photoproductcore.exe
- %TEMP%\nsh2c00.tmp\photoproductcore.sp
- %TEMP%\nsh2c00.tmp\system.dll
Moves the following files
- from %HOMEPATH%\desktop\hp photo creations.lnk to %HOMEPATH%\desktop\hp photo creations.lnk~rf125521.tmp
- from %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\hp photo creations.lnk to %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\hp photo creations.lnk~rf125550.tmp
Substitutes the following files
- %HOMEPATH%\desktop\hp photo creations.lnk
- %APPDATA%\microsoft\windows\start menu\programs\hp\hp photo creations\hp photo creations.lnk
Network activity
Connects to
- 'microsoft.com':80
- 'oc##.thawte.com':80
- 'cr#.#hawte.com':80
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f%2Btw%2FGciJ7fvbA4gIz7D4CEH6T6%2Ft8xk5Z6kuad9QG%2FDs%3D
UDP
- DNS ASK microsoft.com
- DNS ASK oc##.thawte.com
- DNS ASK cr#.#hawte.com
- DNS ASK sh###.###ketlifeproduction.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\rlplatform\rocketlife.exe' -r
- '%APPDATA%\hp photo creations\photoproduct.exe'
- '%APPDATA%\hp photo creations\photoproductcore.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "HP Photo Creations Messager" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "HP Photo Creations Communicator" /F' (with hidden window)
- '%LOCALAPPDATA%\rlplatform\rocketlife.exe' -r' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "HP Photo Creations Messager" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "HP Photo Creations Communicator" /F
